VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 19, 2024· Updated Mar 27, 2025

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

CVE-2024-26308

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

Users are recommended to upgrade to version 1.26, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Commons Compress before 1.26 has an unthrottled resource allocation vulnerability when unpacking a malformed Pack200 file, leading to an OutOfMemoryError.

Vulnerability

Overview

CVE-2024-26308 is an Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. The flaw exists in versions from 1.21 before 1.26, specifically in the component that handles Pack200 file decompression. When a specially crafted or broken Pack200 archive is processed, the library does not properly limit memory allocation, allowing an attacker to trigger an OutOfMemoryError [1][3].

Exploitation

Details

An attacker can exploit this vulnerability by supplying a malformed Pack200 file to an application that uses Apache Commons Compress to unpack it. No authentication or special privileges are required beyond the ability to provide the archive for processing. The attack vector is network-based if the application ingests remote files, or local if the file is uploaded manually. The issue is categorized as a denial-of-service condition because the uncontrolled memory consumption can crash the Java virtual machine [1][3].

Impact

The primary impact is denial of service. By repeatedly triggering the flaw, an attacker can cause the application or service to become unresponsive or crash entirely. This can lead to temporary data unavailability or, in cloud or shared environments, affect other tenants due to resource exhaustion. No confidentiality or integrity compromise has been reported for this CVE [1][3].

Mitigation

The Apache Commons Compress project released version 1.26.0, which fixes the vulnerability by implementing proper memory limits and throttle checks during Pack200 decompression. Users are advised to upgrade to at least version 1.26.0 or later (e.g., 1.28.0 as of the reference). There is no workaround short of avoiding the processing of untrusted Pack200 files in affected versions [1][2][3].

References
  1. NVD - CVE-2024-26308
  2. GitHub - apache/commons-compress: Apache Commons Compress
  3. security - CVE-2024-26308: Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.commons:commons-compressMaven
>= 1.21, < 1.26.01.26.0

Affected products

539

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.